TRW & Co · Fintech and virtual assets
Stablecoins and Payment Tokens in the UAE: Central Bank Rules, Dirham Tokens and the Digital Dirham
Stablecoin regulation UAE businesses must follow turns on use. Payments onshore fall under the Central Bank's Payment Token Services Regulation, which licenses dirham-backed tokens, restricts foreign stablecoins and bans algorithmic and privacy tokens. Trading and custody sit with VARA, the Capital Market Authority, the DFSA or the FSRA. Here is how the regimes fit together in 2026.
Key pointA stablecoin can be lawfully listed for trading yet still be restricted as a means of payment: foreign payment tokens are broadly confined to buying virtual assets onshore, so merchant acceptance needs a dirham payment token.
At a glance
Central Bank regulation
The Payment Token Services Regulation, Circular No. 2/2024, licenses the issuance, conversion, custody and transfer of payment tokens used onshore.
Dirham tokens licensed
Dirham Payment Token issuers need a Central Bank licence and must be UAE-incorporated outside the DIFC and ADGM; ordinary free-zone companies can apply.
Foreign tokens restricted
Issuers of foreign stablecoins must register, and onshore use of foreign payment tokens is broadly limited to purchasing virtual assets, not paying merchants.
Prohibited token types
Algorithmic stablecoins and privacy tokens are prohibited in payment token services, and issuers may not pay interest or holding-period rewards.
Digital dirham basis
Federal Decree-Law No. 6 of 2025, in force since September 2025, includes the dirham in digital form within its definition of currency.
Swipe or scroll →
The core of stablecoin regulation UAE businesses must navigate is a simple distinction: is the token being used to pay for things, or to invest and trade? Payment use onshore falls under the Central Bank of the UAE, whose Payment Token Services Regulation licenses dirham-backed tokens and restricts foreign ones. Trading, custody and issuance as an investment product fall under VARA, the federal Capital Market Authority, the DFSA or the FSRA, depending on location.
As of October 2026, the picture also includes a new central bank law with a statutory basis for the digital dirham. This guide explains how the pieces fit and what issuers, platforms and merchants should do.
The short answer
- Dirham-backed stablecoins used for payments in onshore UAE need a Central Bank licence as a Dirham Payment Token issuer.
- Foreign stablecoins, such as US dollar tokens, are treated as Foreign Payment Tokens. Their issuers must register, and onshore use is restricted, broadly to buying virtual assets rather than paying merchants.
- Algorithmic stablecoins and privacy tokens are prohibited for payment use, and issuers cannot pay interest or holding-period rewards.
- Trading and custody of stablecoins as virtual assets are regulated by VARA in Dubai, the CMA onshore, the DFSA in the DIFC and the FSRA in ADGM.
- The digital dirham is a central bank digital currency, not a stablecoin. The new central bank law includes the dirham in digital form within the definition of currency.
Why does the split matter so much? Because the same token can be lawful in one role and restricted in another. A US dollar stablecoin can be listed on a licensed exchange, held by a licensed custodian and used to buy other virtual assets, yet still be off-limits as a way to pay a shop, a landlord or a supplier onshore. Product teams that design around a single licence often discover this only at launch.
The rest of this guide takes each layer in turn: the Central Bank's payment token rules, the virtual asset regulators, the digital dirham, and the practical steps for issuers, platforms and merchants.
The legal framework for stablecoins and payment tokens
The Central Bank's Payment Token Services Regulation
The Central Bank of the UAE issued the Payment Token Services Regulation in June 2024 as Circular No. 2/2024, with a one-year transition period for compliance. It is published in the CBUAE Rulebook.
The Regulation defines Payment Token Services as the issuance, conversion, and custody and transfer of payment tokens. It creates licence categories for Dirham Payment Token issuers, Payment Token Custodians and Transferors, and Payment Token Conversion providers, and a registration route for issuers of Foreign Payment Tokens.
Licences are available to companies incorporated in the UAE, including those in ordinary free zones, but not to entities in the DIFC or ADGM. Those entities can only register as Foreign Payment Token issuers. VASPs licensed by VARA or the federal securities regulator can seek a non-objection registration, and the Regulation's prohibitions apply to them too.
The new central bank law
Federal Decree-Law No. 6 of 2025, in force from 16 September 2025, replaced the 2018 central bank law. It uses technology-neutral language that reaches decentralised finance platforms, payment tokens and decentralised protocols used in licensed financial activities, and it brings virtual-asset payment services, stored value facilities and open finance within the Central Bank's licensing perimeter at statutory level.
Existing licensees had one year to conform. Penalties increased substantially, and promoting a licensed financial activity without a Central Bank licence is prohibited. See our guide to the new Central Bank law and CBUAE licensing.
Where the virtual asset regulators come in
Stablecoins are also virtual assets. In Dubai outside the DIFC, VARA requires a Category 1 issuance licence for fiat-referenced and asset-referenced tokens and regulates exchanges, brokers and custodians dealing in them. Onshore, the Capital Market Authority, which replaced the SCA on 1 January 2026, regulates virtual asset activities under its April 2026 framework.
In the financial free zones, the DFSA regulates stablecoins within its crypto token regime, and the FSRA introduced a framework for issuing fiat-referenced tokens in ADGM in December 2024. Our guide to which UAE regulator covers which crypto activity maps these boundaries.
What falls outside the payment token rules
Not every token is caught. The Regulation excludes activities already licensed under the Central Bank's Retail Payment Services and Card Schemes Regulation and its Stored Value Facilities Regulation, certain technology and infrastructure services and some intra-group transfers.
It also exempts certain reward or loyalty points and tokens that can only be used for the issuer's own non-financial goods or services. These carve-outs matter for loyalty schemes and closed-loop platforms, but they are narrow, and a token that drifts into wider payment use can lose the exemption. Any stablecoin regulation UAE analysis should test the exemptions against how the token is actually used, not how it was first designed.
Dirham payment tokens versus foreign payment tokens
The most practical part of stablecoin regulation UAE businesses face is the different treatment of dirham-backed and foreign tokens. The Central Bank's policy is clear: onshore payments for goods and services should run on dirham-denominated tokens issued under its licence, while foreign tokens are confined to a narrower role.
| Issue | Dirham Payment Token | Foreign Payment Token |
|---|---|---|
| Authorisation of the issuer | Central Bank licence as a Dirham Payment Token issuer | Registration of the foreign issuer with the Central Bank |
| Who can issue | UAE-incorporated companies, including in ordinary free zones; not DIFC or ADGM entities | Foreign issuers, and DIFC or ADGM entities through the registration route |
| Use for onshore payments | Permitted for goods and services, subject to the Regulation | Restricted; broadly limited to purchasing virtual assets or virtual asset derivatives |
| Merchant acceptance | Permitted | Restricted unless the token is registered and used within the permitted purpose |
| Reserves and redemption | Reserve and safeguarding requirements set by the Regulation | Subject to the registration requirements |
| Interest to holders | Prohibited | Prohibited |
The practical consequence for stablecoin regulation UAE compliance is that a merchant in Dubai or Abu Dhabi accepting a US dollar stablecoin for goods is likely to fall foul of the Regulation, even if a licensed VASP handles the conversion. Payment flows should be redesigned around dirham payment tokens or conventional rails.
Ongoing obligations for licensed payment token businesses
A licence is the start, not the end. Licensed payment token businesses must comply with the Central Bank's Consumer Protection Regulation and meet requirements on capital, safeguarding of customer funds, AML and counter-terrorist financing, white papers, customer disclosures and cyber security.
Agents are permitted, subject to the Central Bank's assessment, and outsourcing must follow its Outsourcing Regulation. In practice, this is the same supervisory culture that applies to payment institutions, so stablecoin regulation UAE compliance teams should expect regular reporting, inspections and change-approval requirements.
Issuing a dirham-backed stablecoin: the process
Under stablecoin regulation UAE rules, issuing a dirham-backed payment token is a regulated banking-style activity, not a token launch. Expect the Central Bank to scrutinise reserves, redemption, governance and technology as closely as it would a payment institution. Our guide to payment services licensing explains the wider payments regime.
- Define the token and its use case. Specify the peg, the reserve model, who will hold the token, where it will be accepted and whether it will be used for payments, trading or both
- Choose the issuing entity. Incorporate onshore or in an ordinary free zone; DIFC and ADGM entities cannot obtain a dirham issuer licence
- Design the reserve and redemption model. Document reserve assets, custody, segregation and the holder's right to redeem at par, and plan for independent attestation
- Build governance and controls. Appoint a board and senior management with relevant experience and prepare risk management, AML, sanctions, cyber security and outsourcing frameworks
- Prepare the white paper and disclosures. Produce a white paper and customer disclosures that explain the token, risks, reserves and redemption in plain terms
- Engage with the Central Bank. Submit the licence application, respond to questions and agree any conditions before launch
- Plan distribution and listings. Line up licensed custodians, exchanges and conversion providers, and check VARA, CMA, DFSA or FSRA requirements for secondary trading
Treat payment use and trading as two separate licensing questions. A token can be validly issued and listed for trading on a virtual asset platform yet still be restricted as a means of payment onshore. Map both uses before you launch, and build the restriction into your product flows and merchant contracts.
Where the digital dirham fits
The digital dirham is the Central Bank's own central bank digital currency programme. Unlike a stablecoin, it is a direct liability of the Central Bank rather than of a private issuer holding reserves.
Federal Decree-Law No. 6 of 2025 includes the dirham in digital form in its definition of currency, giving the programme a statutory basis, and confirms the Central Bank's authority over digital money, tokenisation and payment systems. Businesses planning dirham-based payment tokens should watch how the digital dirham's roll-out shapes demand, interoperability and the Central Bank's supervisory expectations.
For most private businesses, the digital dirham is not a competitor to plan against but an infrastructure question. Payment providers and platforms should check whether their systems can support it alongside licensed dirham payment tokens, and keep their product roadmaps aligned with Central Bank announcements on access and timing as stablecoin regulation UAE policy and the digital dirham develop together.
An illustrative scenario
This scenario is illustrative only and does not describe a real client or matter.
A regional e-commerce marketplace headquartered in a Dubai free zone wants to let shoppers pay with a popular US dollar stablecoin, settling to merchants in dirhams through a VARA-licensed broker.
Analysis under the Payment Token Services Regulation shows that the dollar token is a Foreign Payment Token whose onshore use for goods and services is restricted. The broker's VARA licence does not cure the problem, because the restriction targets the payment use itself.
The marketplace redesigns the feature. Customers can pay with a licensed dirham payment token, while dollar stablecoins are accepted only on the platform's separate investment features, which are licensed for virtual asset activity. The merchant terms, customer disclosures and AML controls are rewritten to match.
Risks and common mistakes
Accepting foreign stablecoins as payment
Merchants and payment platforms often assume that if a stablecoin is widely traded, it can be accepted for goods and services. Under the Payment Token Services Regulation, Foreign Payment Tokens are restricted to narrow purposes such as buying virtual assets. Accepting them for everyday purchases onshore risks breaching the Regulation, and the new central bank law strengthened penalties and enforcement powers.
Offering yield on payment tokens
Issuers cannot pay interest or other benefits linked to how long a customer holds a payment token. Rewards programmes, staking-style returns and revenue-sharing features can cross that line if they function as a return on holding. Review incentive designs carefully and keep payment tokens and yield products in clearly separate, separately licensed structures.
Using algorithmic or privacy tokens
The Regulation prohibits algorithmic stablecoins and privacy tokens in payment token services, and prohibits promoting them. Platforms with broad token lists should screen for these categories and remove them from payment features. Investment-side regulators may have their own restrictions, so check the VARA, CMA, DFSA or FSRA position for trading as well.
Choosing the wrong entity
A DIFC or ADGM entity cannot obtain a Central Bank licence to issue dirham payment tokens. Groups that set up in a financial free zone for other reasons sometimes discover this late. If dirham issuance is part of the plan, structure an onshore or ordinary free-zone issuer from the start.
Weak reserve evidence
Reserve assets, safeguarding and redemption are central to every stablecoin regime. Regulators expect independent, audit-grade evidence, and VARA published a circular in October 2026 setting minimum expectations for reserve asset audits. Treat reserve reporting as a control function owned by finance and compliance, not a marketing page.
The cross-border angle
Global stablecoin issuers, including those regulated in the US, EU, UK or Singapore, need to consider how their token is treated in the UAE before encouraging UAE use. Registration as a Foreign Payment Token issuer is the main route to lawful onshore use within the permitted purposes.
Remittance corridors to India, Bangladesh, Pakistan and the Philippines are an obvious use case, but each side has its own rules on tokens and foreign exchange, and UAE anti-money laundering and Travel Rule obligations apply to transfers. Our guide to AML and the Travel Rule for virtual asset firms sets out those duties.
Institutional business is often booked in the DIFC or ADGM, where stablecoins are regulated within the DFSA and FSRA frameworks. That works for professional-client trading and treasury use inside the financial free zones, but it does not by itself authorise onshore payment use, which remains a Central Bank question.
Checklist: stablecoin regulation UAE essentials
Before launching any stablecoin product in or into the UAE, work through these points.
- Classify each token: dirham payment token, foreign payment token, other virtual asset or prohibited token.
- Separate payment use from trading and custody, and map each to its regulator.
- Confirm that the issuing entity is eligible for the licence or registration you need.
- Document reserves, safeguarding and redemption, with independent attestation.
- Remove interest-style rewards from payment tokens.
- Screen token lists for algorithmic and privacy tokens in payment features.
- Align AML, sanctions and Travel Rule controls with UAE requirements.
- Track Central Bank, CMA and VARA updates as stablecoin regulation UAE rules continue to develop.
TRW & Co advises issuers, platforms and merchants on payment token licensing, product design and regulatory mapping through our payment services and virtual assets practices, including token issuance. Contact us to discuss your plans.
Frequently asked questions
01Are stablecoins legal in the UAE?
Yes, within a regulated framework. The Central Bank of the UAE licenses dirham-backed payment tokens and requires registration of foreign payment token issuers under its Payment Token Services Regulation. Algorithmic stablecoins and privacy tokens are prohibited for payment use. Trading and custody of stablecoins as virtual assets are regulated by VARA in Dubai, the Capital Market Authority onshore, the DFSA in the DIFC and the FSRA in ADGM.
02Can I pay for goods in the UAE with USDT or USDC?
Generally not for ordinary goods and services onshore. US dollar stablecoins are Foreign Payment Tokens under the Central Bank's Regulation, and their onshore use is broadly restricted to purchasing virtual assets or virtual asset derivatives, provided the issuer is registered. Merchant acceptance for everyday purchases is expected to run on licensed dirham payment tokens or conventional payment rails.
03Who can issue a dirham-backed stablecoin?
A company incorporated in the UAE, including in an ordinary free zone, can apply to the Central Bank for a licence as a Dirham Payment Token issuer. Entities in the DIFC and ADGM cannot obtain this licence and can only register as foreign payment token issuers. Applicants must meet requirements on capital, reserves, safeguarding, governance, AML, cyber security and disclosure, including a white paper.
04What is the difference between a stablecoin and the digital dirham?
A stablecoin is issued by a private company and backed by reserve assets it holds, so holders depend on the issuer's reserves and redemption arrangements. The digital dirham is the Central Bank's own digital currency programme and is a liability of the Central Bank itself. The 2025 central bank law includes the dirham in digital form within the definition of currency.
05Does VARA regulate stablecoins?
VARA regulates stablecoins as virtual assets in Dubai outside the DIFC. Issuing fiat-referenced or asset-referenced tokens requires a VARA Category 1 issuance licence, and exchanges, brokers and custodians dealing in stablecoins need the relevant VARA activity licences. If the token is used for payments onshore, the Central Bank's Payment Token Services Regulation also applies.
06Can a stablecoin issuer pay interest to holders in the UAE?
No, for payment tokens. The Payment Token Services Regulation prohibits issuers from paying interest or other benefits linked to how long a customer holds a payment token. Products that offer yield on stablecoins need careful structuring, and may fall under a separate virtual asset licence such as lending and borrowing or investment management.
Sources and official materials
- Central Bank of the UAE — Payment token services, payment regulation and the digital dirham
- CBUAE Rulebook — Payment Token Services Regulation and related regulations
- Virtual Assets Regulatory Authority — VARA issuance rules for fiat-referenced tokens in Dubai
- Capital Market Authority — Federal virtual asset framework from 2026
- Dubai Financial Services Authority — Crypto token regime in the DIFC
- ADGM Financial Services Regulatory Authority — Fiat-referenced token framework in ADGM
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
